from lib.cuckoo.common.abstracts import Signature


class ProgramFail2Start(Signature):
    name = "program_fail2start"
    description = "Attempted operation caused the program to fail to start normally."
    severity = 3
    categories = ["file"]
    authors = ["xuhy"]
    minimum = "2.0"

    dlls_re = [
        ".*(ADVAPI32|advapi32).(dll|DLL)?",
        ".*SHLWAPI.(dll|DLL)?",
        ".*gdi32.(dll|DLL)?",
        ".*IMM32.(dll|DLL)?",
    ]

    files_re = [
        ".*\\\\System32\\\\MSCOREE",
        ".*\\\\Microsoft.NET\\\\Framework\\\\.*\\\\(mscoreei|mscorwks).(dll|DLL)?",
    ]

    file_actions = [
        "file_opened", "file_exists", "file_failed", "directory_enumerated",
    ]

    def on_complete(self):
        for indicator in self.files_re:
            for filepath in self.check_file(pattern=indicator, regex=True, all=True):
                self.mark_ioc("file", filepath)
        for dll_re in self.dlls_re:
            for filepath in self.check_file(pattern=dll_re, regex=True, all=True):
                self.mark_ioc("file", filepath)
            for dll in self.check_dll_loaded(pattern=dll_re, regex=True, all=True):
                self.mark_ioc("dll", dll)
        return self.has_marks()
